Add a customizable HTTP/HTTPS block page for sinkholed queries

Serves a page explaining why a domain was blocked instead of leaving a
sinkholed client with a dead connection. Binds its own HTTP/HTTPS
listeners with self-signed, per-hostname TLS certs generated on the
fly, re-evaluates the requesting client against the policy engine per
request, and renders an HTML template editable from Settings with a
live preview.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TTKpGMQzpfDsvedu1hvSUf

web/static/js/app.js

@@ -254,6 +254,37 @@
     if (input.value) { update(); }
   }
 
+  // --- Block page live preview -------------------------------------------
+
+  /** Renders the (unsaved) block page HTML in an iframe as the operator types. */
+  function initBlockPagePreview() {
+    var textarea = document.getElementById('blockPageHTML');
+    var frame = document.getElementById('blockPagePreview');
+    if (!textarea || !frame) { return; }
+    var form = textarea.form;
+
+    var timer = null;
+    function update() {
+      var body = new URLSearchParams();
+      body.set('html', textarea.value);
+      var csrf = form.querySelector('[name="_csrf"]');
+      if (csrf) { body.set('_csrf', csrf.value); }
+      fetch(form.getAttribute('data-preview-url'), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString()
+      }).then(function (r) { return r.text(); }).then(function (html) {
+        frame.srcdoc = html;
+      }).catch(function () { /* leave the last good preview showing */ });
+    }
+
+    textarea.addEventListener('input', function () {
+      clearTimeout(timer);
+      timer = setTimeout(update, 400);
+    });
+    update();
+  }
+
   // --- Page data --------------------------------------------------------
 
   /* Page data is delivered in data- attributes rather than inline <script>
@@ -533,6 +564,7 @@
     initBulkSelect();
     initCopyButtons();
     initReversePreview();
+    initBlockPagePreview();
     initRecordEditor();
     initDelegatedActions();
     initCharts();